Uber Technologies Inc

Previous wording

•We have experienced and may experience security or data privacy breaches or other unauthorized or improper access to, use of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data.

Current wording

•We have experienced and may experience security or data privacy breaches or other unauthorized or improper access to, acquisition of, use of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data.

Previous wording

In November 2020, California voters approved Proposition 22, a California state ballot initiative that provides a framework for drivers that use platforms like ours for independent work. Proposition 22 went into effect in December 2020 and we expect that Drivers will be able to maintain their status as independent contractors under California law and that we and our competitors will be required to comply with the provisions of Proposition 22. Although our stipulation to dissolve the California Attorney General’s preliminary injunction was granted in April 2021, that litigation remains pending, and we also may face liability relating to periods before the effective date of Proposition 22. Legal challenges, including constitutional challenges, to Proposition 22 have been and may continue to be filed.

Current wording

Drivers will be able to maintain their status as independent contractors under California law and that we and our competitors will be required to comply with the provisions of Proposition 22. Although our stipulation to dissolve the California Attorney General’s preliminary injunction was granted in April 2021, that litigation remains pending, and we also may face liability relating to periods before the effective date of Proposition 22. The California Supreme Court upheld the constitutionality of Proposition 22; however, legal challenges, including constitutional challenges, to Proposition 22 may continue to be filed.

Previous wording

We face similar challenges in other jurisdictions within the United States and abroad. For example, in July 2020, the Massachusetts Attorney General filed a complaint against Uber and Lyft, alleging that drivers are misclassified, and seeking an injunction. If we do not prevail in current litigation or similar actions that may be brought in the future, we may be required to treat Drivers as employees and/or make other changes to our business model in certain jurisdictions. If, as a result of legislation or judicial decisions, we are required to classify Drivers as employees, we would incur significant additional expenses for compensating Drivers, including expenses associated with the application of wage and hour laws (including minimum wage, overtime, and meal and rest period requirements), employee benefits, social security contributions, taxes (direct and indirect), and potential penalties. In this case, we anticipate significant price increases for Riders to offset these additional costs; however, we believe that the financial impact to Uber would be moderated by the likelihood of other industry participants being similarly affected. Additionally, we may not have adequate Driver supply as Drivers may opt out of our platform given the loss of flexibility under an employment model, and we may not be able to hire a majority of the Drivers currently using our platform. Further, any such reclassification would require us to fundamentally change our business model, and consequently have an adverse effect on our business, results of operations, financial position and cash flows.

Current wording

We face similar challenges in other jurisdictions within the United States and abroad. For example, in July 2020, the Massachusetts Attorney General filed a complaint against Uber and Lyft, alleging that drivers are misclassified, and seeking an injunction. That case was resolved in June 2024 with the understanding that drivers would continue to be classified as independent contractors. If we do not prevail in current litigation or similar actions that may be brought in the future, we may be required to treat Drivers as employees and/or make other changes to our business model in certain jurisdictions. If, as a result of legislation or judicial decisions, we are required to classify Drivers as employees, we would incur significant additional expenses for compensating Drivers, including expenses associated with the application of wage and hour laws (including minimum wage, overtime, and meal and rest period requirements), employee benefits, social security contributions, taxes (direct and indirect), and potential penalties. In this case, we anticipate significant price increases for Riders to offset these additional costs; however, we believe that the financial impact to Uber would be moderated by the likelihood of other industry participants being similarly affected. Additionally, we may not have adequate Driver supply as Drivers may opt out of our platform given the loss of flexibility under an employment model, and we may not be able to hire a majority of the Drivers currently using our platform. Further, any such reclassification would require us to fundamentally change our business model, and consequently have an adverse effect on our business, results of operations, financial position and cash flows.

Previous wording

In addition, reclassification of Drivers as employees, workers or quasi-employees where those statuses exist, have and could lead to groups of Drivers becoming represented by labor unions and similar organizations. For example, in May 2021, we formally recognized a UK driver union. If a significant number of Drivers were to become unionized and collective bargaining agreement terms were to deviate significantly from our business model, our business, financial condition, operating results and cash flows could be materially adversely affected. In addition, a labor dispute involving Drivers may harm our reputation, disrupt our operations and reduce our net revenues, and the resolution of labor disputes may increase our costs.

Current wording

In addition, reclassification of Drivers as employees, workers or quasi-employees where those statuses exist, have and could lead to groups of Drivers becoming represented by labor unions and similar organizations. For example, in May 2021, we formally recognized a UK driver union and in 2024, voters in Massachusetts will decide whether to adopt a ballot initiative allowing drivers to collectively bargain as independent contractors. If a significant number of Drivers were to become unionized and collective bargaining agreement terms were to deviate significantly from our business model, our business, financial condition, operating results and cash flows could be materially adversely affected. In addition, a labor dispute involving Drivers may harm our reputation, disrupt our operations and reduce our net revenues, and the resolution of labor disputes may increase our costs.

Previous wording

•Freight. Our Freight offering competes with global and North American freight brokers and managed transportation providers such as C.H. Robinson, Total Quality Logistics, XPO Logistics, Echo Global Logistics, Coyote, Transfix, DHL, and NEXT Trucking.

Current wording

•Freight. Our Freight offering competes with global and North American freight brokers and managed transportation providers such as C.H. Robinson, Total Quality Logistics, RXO, XPO, Echo Global Logistics, DHL, and NEXT Trucking.

Previous wording

Additionally, if we are unable to obtain regulatory approval of any acquisitions, we may not ultimately consummate such acquisitions or may consummate them only in jurisdictions where antitrust approval is obtained. Further, in order to obtain regulatory approval of acquisitions, we may be required to divest all or part of our or the target company’s operations or agree to other remedies. Any such remedies could result in additional competition in some or all markets.

Current wording

Additionally, if we are unable to obtain regulatory approval of any acquisitions, we may not ultimately consummate such acquisitions, may be required to pay termination fees or may consummate them only in jurisdictions where antitrust approval is obtained. Further, in order to obtain regulatory approval of acquisitions, we may be required to divest all or part of our or the target company’s operations or agree to other remedies. Any such remedies could result in additional competition in some or all markets.

Previous wording

We incurred operating losses of $3.8 billion and $1.8 billion in the years ended December 31, 2021 and 2022, respectively, and, as of March 31, 2024, we had an accumulated deficit of $31.2 billion. We will need to generate and sustain increased revenue levels and decrease proportionate expenses in future periods to achieve or maintain profitability in many of our largest markets, including in the United States, and even if we do, we may not be able to maintain or increase profitability. We may continue to incur losses in the near term as a result of substantial increases in our operating expenses, as we continue to invest in order to: increase the number of Drivers, consumers, merchants, Shippers, and Carriers using our platform through incentives, discounts, and promotions; expand within existing or into new markets; increase our research and development expenses; expand marketing channels and operations; hire additional employees; and add new products and offerings to our platform. These efforts may prove more expensive than we anticipate, and we may not succeed in increasing our revenue sufficiently to offset these expenses. Many of our efforts to generate revenue are new and unproven, and any failure to adequately increase revenue or contain the related costs could prevent us from attaining or increasing profitability. In addition, we sometimes introduce new products that we expect to add value to our overall platform and network but which we expect will generate lower Gross Bookings per Trip or a lower Revenue Margin. Further, we charge a lower service fee to certain of our largest chain restaurant partners on our Delivery offering to grow the number of Delivery consumers, which may at times result in a negative Revenue Margin with respect to those transactions after considering amounts collected from consumers and paid to Drivers. As we expand our offerings to additional cities, our offerings in these cities may be less profitable than the markets in which we currently operate. As such, we may not be able to achieve or maintain profitability in the near term, in accordance with our expectations, or at all. Additionally, we may not realize the operating efficiencies we expect to achieve as a result of our acquisition of Careem, Postmates or other acquired companies, and may continue to incur significant operating losses in the United States, Middle East, North Africa, and Pakistan in the future. Even if we do experience operating efficiencies, our operating results may not improve, at least in the near term.

Current wording

We incurred operating losses of $3.8 billion and $1.8 billion in the years ended December 31, 2021 and 2022, respectively, and, as of June 30, 2024, we had an accumulated deficit of $30.2 billion. We will need to generate and sustain increased revenue levels and decrease proportionate expenses in future periods to achieve or maintain profitability in many of our largest markets, including in the United States, and even if we do, we may not be able to maintain or increase profitability. We may continue to incur losses in the near term as a result of substantial increases in our operating expenses, as we continue to invest in order to: increase the number of Drivers, consumers, merchants, Shippers, and Carriers using our platform through incentives, discounts, and promotions; expand within existing or into new markets; increase our research and development expenses; expand marketing channels and operations; hire additional employees; and add new products and offerings to our platform. These efforts may prove more expensive than we anticipate, and we may not succeed in increasing our revenue sufficiently to offset these expenses. Many of our efforts to generate revenue are new and unproven, and any failure to adequately increase revenue or contain the related costs could prevent us from attaining or increasing profitability. In addition, we sometimes introduce new products that we expect to add value to our overall platform and network but which we expect will generate lower Gross Bookings per Trip or a lower Revenue Margin. Further, we charge a lower service fee to certain of our largest chain restaurant partners on our Delivery offering to grow the number of Delivery consumers, which may at times result in a negative Revenue Margin with respect to those transactions after considering amounts collected from consumers and paid to Drivers. As we expand our offerings to additional cities, our offerings in these cities may be less profitable than the markets in which we currently operate. As such, we may not be able to achieve or maintain profitability in the near term, in accordance with our expectations, or at all. Additionally, we may not realize the operating efficiencies we expect to achieve as a result of our acquisition of Careem, Postmates or other acquired companies, and may continue to incur significant operating losses in the United States, Middle East, North Africa, and Pakistan in the future. Even if we do experience operating efficiencies, our operating results may not improve, at least in the near term.

Previous wording

As our operations have expanded, we have grown from 159 employees as of December 31, 2012 to approximately 30,700 global employees as of March 31, 2024, of whom approximately 17,600 were located outside the United States. The total number of our employees located outside the United States has increased and may continue to increase as we expand globally. Properly managing our growth will require us to continue to hire, train, and manage qualified employees and staff, including engineers, operations personnel, financial and accounting staff, and sales and marketing staff, and to improve and maintain our technology. If our new hires perform poorly, if we are unsuccessful in hiring, training, managing, and integrating new employees and staff, or if we are not successful in retaining our existing employees and staff, our business may be harmed. Moreover, in order to optimize our organizational structure, we have implemented several reductions in workforce and restructurings, and may in the future implement other reductions in workforce. Any reduction in workforce or restructuring may yield unintended consequences and costs, such as attrition beyond the intended reduction in workforce, the distraction of employees, or reduced employee morale and could adversely affect our reputation as an employer, which could make it more difficult for us to hire new employees in the future and increase the risk that we may not achieve the anticipated benefits from the reduction in workforce. Properly managing our growth or any reductions in workforce will require us to establish consistent policies across regions and functions, and a failure to do so could likewise harm our business.

Current wording

As of June 30, 2024, we had approximately 30,400 global employees, of whom approximately 17,500 were located outside the United States. The total number of our employees located outside the United States has increased and may continue to increase as we expand globally. Properly managing our growth will require us to continue to hire, train, and manage qualified employees and staff, including engineers, operations personnel, financial and accounting staff, and sales and marketing staff, and to improve and maintain our technology. If our new hires perform poorly, if we are unsuccessful in hiring, training, managing, and integrating new employees and staff, or if we are not successful in retaining our existing employees and staff, our business may be harmed. Moreover, in order to optimize our organizational structure, we have implemented several reductions in workforce and restructurings, and may in the future implement other reductions in workforce. Any reduction in workforce or restructuring may yield unintended consequences and costs, such as attrition beyond the intended reduction in workforce, the distraction of employees, or reduced employee morale and could adversely affect our reputation as an employer, which could make it more difficult for us to hire new employees in the future and increase the risk that we may not achieve the anticipated benefits from the reduction in workforce. Properly managing our growth or any reductions in workforce will require us to establish consistent policies across regions and functions, and a failure to do so could likewise harm our business.

Previous wording

As of March 31, 2024, we operated in approximately 70 countries, and markets outside the United States accounted for approximately 77% of all Trips during the three months ended March 31, 2024. We have limited experience operating in many jurisdictions outside of the United States and have made, and expect to continue to make, significant investments to expand our international operations and compete with local and other global competitors. For example, our acquisitions of Careem and Cornershop may not be successful and may negatively affect our operating results.

Current wording

As of June 30, 2024, we operated in approximately 70 countries. We have limited experience operating in many jurisdictions outside of the United States and have made, and expect to continue to make, significant investments to expand our international operations and compete with local and other global competitors.

Previous wording

We have invested, and we may continue to invest, substantial amounts in companies with whom we partner to offer autonomous vehicle technologies on our platform. For example, in January 2021, we completed the merger of our autonomous technologies business with Aurora, and included a $400 million investment in the combined company and a commercial agreement pursuant to which we and Aurora will collaborate with respect to the launch and commercialization of self-driving vehicles on our ridesharing network. We believe that autonomous vehicle technologies may have the ability to meaningfully impact the industries in which we compete and that autonomous vehicles present substantial opportunities. Several companies other than Aurora, including Waymo, Cruise Automation, Tesla, Apple, Zoox (which Amazon has acquired), Aptiv, and Nuro, are developing autonomous vehicle technologies, either alone or through collaborations with car manufacturers, and we expect that they will use such technology to further compete with us in the mobility, delivery, or logistics industries. Waymo has already introduced a commercialized ridehailing fleet of autonomous vehicles, and it is possible that our competitors could introduce autonomous vehicle offerings earlier than we will be able to offer autonomous vehicles on our platform through our commercial agreement with Aurora or other partners. In the event that our competitors bring autonomous vehicles to market before we are able to offer autonomous vehicles on our platform, or their technology is or is perceived to be superior to the technology of parties with which we partner to offer autonomous vehicles on our platform, they may be able to leverage such technology to compete more effectively with us, which would adversely impact our financial performance and our prospects. For example, use of autonomous vehicles could substantially reduce the cost of providing ridesharing, delivery, or logistics services, which could allow competitors to offer such services at a substantially lower price as compared to the price available to consumers on our platform. If a significant number of consumers choose to use our competitors’ offerings over ours, our financial performance and prospects would be adversely impacted.

Current wording

We have invested, and we may continue to invest, substantial amounts in companies with whom we partner to offer autonomous vehicle technologies on our platform. For example, in January 2021, we completed the merger of our autonomous technologies business with Aurora, and included a $400 million investment in the combined company and a commercial agreement pursuant to which we and Aurora will collaborate with respect to the launch and commercialization of self-driving vehicles on our ridesharing network. We believe that autonomous vehicle technologies may have the ability to meaningfully impact the industries in which we compete and that autonomous vehicles present substantial opportunities. Several companies other than Aurora, including Waymo, Cruise Automation, Tesla, Apple, Zoox (a subsidiary of Amazon), Aptiv, and Nuro, are developing autonomous vehicle technologies, either alone or through collaborations with car manufacturers, and we expect that they will use such technology to further compete with us in the mobility, delivery, or logistics industries. Waymo has already introduced a commercialized ridehailing fleet of autonomous vehicles, and it is possible that our competitors could introduce autonomous vehicle offerings earlier than we will be able to offer autonomous vehicles on our platform through our commercial agreement with Aurora or other partners. In the event that our competitors bring autonomous vehicles to market before we are able to offer autonomous vehicles on our platform, or their technology is or is perceived to be superior to the technology of parties with which we partner to offer autonomous vehicles on our platform, they may be able to leverage such technology to compete more effectively with us, which would adversely impact our financial performance and our prospects. For example, use of autonomous vehicles could substantially reduce the cost of providing ridesharing, delivery, or logistics services, which could allow competitors to offer such services at a substantially lower price as compared to the price available to consumers on our platform. If a significant number of consumers choose to use our competitors’ offerings over ours, our financial performance and prospects would be adversely impacted.

Previous wording

We collect, use, and process a variety of personal data, such as email addresses, mobile phone numbers, profile photos, location information, drivers’ license numbers and Social Security numbers of Drivers, consumer payment card information, and Driver and merchant bank account information. As such, we are an attractive target of data security attacks by third parties. Any failure to prevent or mitigate security breaches or improper access to, or use, acquisition, disclosure, alteration or destruction of, any such data could result in significant liability and a material loss of revenue resulting from the adverse impact on our reputation and brand, a diminished ability to retain or attract new platform users, and disruption to our business. We rely on third-party service providers to host or otherwise process some of our data and that of platform users, and they have experienced, and may again experience, security and privacy incidents. Any failure by such third party to prevent or mitigate security breaches or improper access to, or use, acquisition, disclosure, alteration, or destruction of, such data could have similar adverse consequences for us.

Current wording

We collect, use, and process a variety of personal data, such as email addresses, mobile phone numbers, profile photos, location information, drivers’ license numbers and Social Security numbers of Drivers, consumer payment card information, and Driver and merchant bank account information. As such, we are an attractive target of data security attacks by third parties and insiders. Any failure to prevent or mitigate security breaches or improper access to, or use, acquisition, disclosure, alteration or destruction of, any such data could result in significant liability and a material loss of revenue resulting from the adverse impact on our reputation and brand, a diminished ability to retain or attract new platform users, and disruption to our business. We rely on third-party service providers to host or otherwise process some of our data and that of platform users, and they have experienced, and may again experience, security and privacy incidents. Any failure by such third party to prevent or mitigate security breaches or improper access to, or use, acquisition, disclosure, alteration, or destruction of, such data could have similar adverse consequences for us.

Previous wording

Because the techniques used to obtain unauthorized access, disable or degrade services, or sabotage systems change frequently and are often unrecognizable until launched against a target, we may be unable to anticipate these techniques and implement adequate preventative measures. Our servers and platform may be vulnerable to computer viruses or physical or electronic break-ins that our security measures may not detect. Individuals able to circumvent our security measures may misappropriate confidential, proprietary, or personal information held by or on behalf of us, disrupt our operations, damage our computers, or otherwise damage our business. In addition, we may need to expend significant resources to protect against security breaches or mitigate the impact of any such breaches, including potential liability that may not be limited to the amounts covered by our insurance.

Current wording

Because the techniques used to obtain unauthorized access, disable or degrade services, or sabotage systems change frequently and are often unrecognizable until launched against a target, we may be unable to anticipate these techniques and implement adequate preventative measures. Our servers, internal systems, and platform may be vulnerable to computer viruses or physical or electronic break-ins that our security measures may not detect. Individuals able to circumvent our security measures may misappropriate confidential, proprietary, or personal information held by or on behalf of us, disrupt our operations, damage our computers, or otherwise damage our business. In addition, we may need to expend significant resources to protect against security breaches or mitigate the impact of any such breaches, including potential liability that may not be limited to the amounts covered by our insurance.

Previous wording

Security breaches could also expose us to liability under various laws and regulations across jurisdictions and increase the risk of litigation and governmental investigation. We have been subject to security and privacy incidents in the past and may be again in the future. For example, in September 2022, we experienced a cybersecurity incident where an attacker accessed certain internal corporate systems, tools and data. In October and November of 2016, outside actors downloaded the personal data of approximately 57 million Drivers and consumers worldwide (the “2016 Breach”). The accessed data included the names, email addresses, mobile phone numbers, and drivers’ license numbers of approximately 600,000 Drivers, among other information. For further information on this incident, see the risk factors titled “—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, state Attorney General (“AG”) offices, and other U.S. and foreign government agencies, the adverse outcomes of which could harm our business” and “—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative, and regulatory action, and negative press about our privacy and data protection practices,” below. As we expand our operations, we may also assume liabilities for breaches experienced by the companies we acquire. For example, in April 2018, Careem publicly disclosed and notified relevant regulatory authorities that it had been subject to a data security incident that allowed access to certain personal information of riders and drivers on its platform, as of January 14, 2018. If Careem becomes subject to liability as a result of this or other data security incidents, or if we fail to remediate this or any other data security incident that Careem or we experience, we may face harm to our brand, business disruption, and significant liabilities. In addition, in July 2020, Drizly publicly disclosed that it had been subject to a data security incident that allowed access to certain personal information of customers on its platform, and in November 2021 Drizly obtained final court approval of a settlement in a resulting class action litigation. Moreover, in January 2023, the U.S. Federal Trade Commission (the “FTC”) announced a final order relating to the data security incident. If we fail to remediate this or any other data security incident that we experience, we may face harm to our brand, business disruption, and significant liabilities. Security and privacy incidents have led to, and may continue to lead to, additional regulatory scrutiny.

Current wording

Security breaches could also expose us to liability under various laws and regulations across jurisdictions and increase the risk of litigation and governmental investigation. We have been subject to security and privacy incidents in the past and may be again in the future. For example, in September 2022, we experienced a cybersecurity incident where an attacker accessed certain internal corporate systems, tools and data. In October and November of 2016, outside actors downloaded the personal data of approximately 57 million Drivers and consumers worldwide (the “2016 Breach”). The accessed data included the names, email addresses, mobile phone numbers, and drivers’ license numbers of approximately 600,000 Drivers, among other information. For further information on this incident, see the risk factors titled “—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business” and “—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative, and regulatory action, and negative press about our privacy and data protection practices,” below. As we expand our operations, we may also assume liabilities for breaches experienced by the companies we acquire. For example, in April 2018, Careem publicly disclosed and notified relevant regulatory authorities that it had been subject to a data security incident that allowed access to certain personal information of riders and drivers on its platform, as of January 14, 2018. If Careem becomes subject to liability as a result of this or other data security incidents, or if we fail to remediate this or any other data security incident that Careem or we experience, we may face harm to our brand, business disruption, and significant liabilities. In addition, in July 2020, Drizly publicly disclosed that it had been subject to a data security incident that allowed access to certain personal information of customers on its platform, and in November 2021 Drizly obtained final court approval of a settlement in a resulting class action litigation. Moreover, in January 2023, the U.S. Federal Trade Commission (the “FTC”) announced a final order relating to the data security incident. If we fail to remediate this or any other data security incident that we experience, we may face harm to our brand, business disruption, and significant liabilities. Security and privacy incidents have led to, and may continue to lead to, additional regulatory scrutiny.

Previous wording

Various other factors may also cause system failures or security breaches, including power outages, catastrophic events, inadequate or ineffective redundancy, issues with upgrading or creating new systems or platforms, flaws in third-party software or services, errors by our employees or third-party service providers, or breaches in the security of these systems or platforms. For example, fraudsters may attempt to induce employees, contractors, or platform users to disclose information to gain access to our data or the data of platform users. If our incident response, disaster recovery, and business continuity plans do not resolve these issues in an effective manner, they could result in adverse impacts to our business operations and our financial results. Because of our prominence, the number of platform users, and the types and volume of personal data on our systems, we may be a particularly attractive target for such attacks. Although we have developed, and continue to develop, systems and processes that are designed to protect our data and that of platform users, and to prevent data loss, undesirable activities on our platform, and security breaches, we cannot guarantee that such measures will provide absolute security. Our efforts on this front may be unsuccessful as a result of, for example, software bugs or other technical malfunctions; employee, contractor, or vendor error or malfeasance; government surveillance; or other threats that evolve, and we may incur significant costs in protecting against or remediating cyber-attacks. Any actual or perceived failure to maintain the performance, reliability, security, and availability of our products, offerings, and technical infrastructure to the satisfaction of platform users and certain regulators would likely harm our reputation and result in loss of revenue from the adverse impact to our reputation and brand, disruption to our business, and our decreased ability to attract and retain Drivers, consumers, merchants, Shippers, and Carriers.

Current wording

Various other factors may also cause system failures or security breaches, including power outages, catastrophic events, inadequate or ineffective redundancy, issues with upgrading or creating new systems or platforms, flaws in third-party software or services, intentional acts or errors by our employees or third-party service providers, or breaches in the security of these systems or platforms. For example, fraudsters may attempt to induce employees, contractors, or platform users to disclose information to gain access to our data or the data of platform users. If our incident response, disaster recovery, and business continuity plans do not resolve these issues in an effective manner, they could result in adverse impacts to our business operations and our financial results. Because of our prominence, the number of platform users, and the types and volume of personal data on our systems, we may be a particularly attractive target for such attacks. Although we have developed, and continue to develop, systems and processes that are designed to protect our data and that of platform users, and to prevent data loss, undesirable activities on our platform, and security breaches, we cannot guarantee that such measures will provide absolute security. Our efforts on this front may be unsuccessful as a result of, for example, software bugs or other technical malfunctions; employee, contractor, or vendor error or malfeasance; government surveillance; or other threats that evolve, and we may incur significant costs in protecting against or remediating cyber-attacks. Any actual or perceived failure to maintain the performance, reliability, security, and availability of our products, offerings, and technical infrastructure to the satisfaction of platform users and certain regulators would likely harm our reputation and result in loss of revenue from the adverse impact to our reputation and brand, disruption to our business, and our decreased ability to attract and retain Drivers, consumers, merchants, Shippers, and Carriers.

Previous wording

Our growing use of artificial intelligence (“AI”) (including machine learning) in our business and offerings presents additional risks. This technology presents a number of risks inherent in its use. AI algorithms or automated processing of data may be flawed and datasets may be insufficient or contain biased information, which can create inaccurate or discriminatory outcomes. AI tools and algorithms may use third-party AI with unclear intellectual property rights or interests. Intellectual property ownership and license rights, including copyright, of generative and other AI output, have not been fully interpreted by courts or regulations. Europe, the United States and other countries are enacting or may consider comprehensive legal compliance frameworks specifically for AI, which is a trend that may increase now that European lawmakers have passed the first such framework, expected to come into effect in 2024. Further, more specific AI-related laws and regulations have been enacted, and are expected to continue to be enacted, around the world. Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business. AI use or management by us or others, including certain decisions based (whether partially or solely) on automated processing or profiling, inappropriate or controversial data practices, or insufficient disclosures regarding machine learning and algorithms or AI-generated content, have and could impair the acceptance of AI solutions or subject us to lawsuits, regulatory investigations or other harm, such as negative impacts to the value of our intellectual property or our brand. These and other deficiencies could also undermine the decisions, predictions or analysis AI applications produce, or lead to unintentional bias and discrimination, subjecting us to competitive harm, legal liability, and brand or reputational harm. The rapid evolution of AI may require us to allocate additional resources to help implement AI ethically in order to minimize unintended or harmful impacts, and may also require us to make additional investments in the development of proprietary datasets, machine learning models or other systems, which may be costly.

Current wording

Our growing use of artificial intelligence (“AI”) (including machine learning) in our business and offerings presents additional risks. This technology presents a number of risks inherent in its use. AI algorithms or automated decision-making or processing of data may be flawed and datasets may be insufficient or contain biased information, which can create inaccurate or discriminatory outcomes. AI tools and algorithms may use third-party AI with unclear intellectual property rights or interests. Intellectual property ownership and license rights, including copyright, of generative and other AI output, have not been fully interpreted by courts or regulations. Europe, the United States and other countries are enacting or may consider comprehensive legal compliance frameworks specifically for AI, which is a trend that may increase now that European lawmakers have passed the first such framework, expected to come into effect in 2024. Further, more specific AI-related laws and regulations have been enacted, and are expected to continue to be enacted, around the world. Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business. AI use or management by us or others, including certain decisions based (whether partially or solely) on automated processing or profiling, inappropriate or controversial data practices, or insufficient disclosures regarding machine learning and algorithms or AI-generated content, have and could impair the acceptance of AI solutions or subject us to lawsuits, regulatory investigations or other harm, such as negative impacts to the value of our intellectual property or our brand. These and other deficiencies could also undermine the decisions, predictions or analysis AI applications produce, or lead to unintentional bias and discrimination, subjecting us to competitive harm, legal liability, and brand or reputational harm. The rapid evolution of AI may require us to allocate additional resources to help implement AI ethically in order to minimize unintended or harmful impacts, and may also require us to make additional investments in the development of proprietary datasets, machine learning models or other systems, which may be costly.

Previous wording

While we employ practices designed to monitor our compliance with the licenses of third-party open source software and protect our valuable proprietary source code, we have not run a complete open source license review and may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the applicable terms of such license, including claims for infringement of intellectual property rights or for breach of contract. Furthermore, there is an increasing number of open-source software license types, almost none of which have been tested in a court of law, resulting in a dearth of guidance regarding the proper legal interpretation of such licenses. If we were to receive a claim of non-compliance with the terms of any of our open source licenses, we may be required to publicly release certain portions of our proprietary source code or expend substantial time and resources to re-engineer some or all of our software.

Current wording

We use third-party open source software in connection with the development of our platform. From time to time, companies that use third-party open source software have faced claims challenging the use of such open source software and their compliance with the terms of the applicable open source license. We may be subject to suits by parties claiming ownership of what we believe to be open source software, or claiming non-compliance with the applicable open source licensing terms. Some open source licenses require end-users who distribute or make available across a network software and services that include open source software to make available all or part of such software, which in some circumstances could include valuable proprietary code. While we employ practices designed to monitor our compliance with the licenses of third-party open source software and protect our valuable proprietary source code, we have not run a complete open source license review and may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the applicable terms of such license, including claims for infringement of intellectual property rights or for breach of contract. Furthermore, there is an increasing number of open-source software license types, almost none of which have been tested in a court of law, resulting in a dearth of guidance regarding the proper legal interpretation of such licenses. If we were to receive a claim of non-compliance with the terms of any of our open source licenses, we may be required to publicly release certain portions of our proprietary source code or expend substantial time and resources to re-engineer some or all of our software.

Previous wording

As of March 31, 2024, we had total outstanding indebtedness of $9.6 billion aggregate principal amount. In addition, up to approximately $128 million of Careem Convertible Notes remain subject to future issuance to Careem stockholders as of March 31, 2024. Subject to the limitations in the terms of our existing and future indebtedness, we and our subsidiaries may incur additional debt, secure existing or future debt, or refinance our debt. In particular, we may need to incur additional debt to finance the purchase of autonomous vehicles, and such financing may not be available to us on attractive terms or at all.

Current wording

As of June 30, 2024, we had total outstanding indebtedness of $9.5 billion aggregate principal amount. In addition, up to approximately $128 million of Careem Convertible Notes remain subject to future issuance to Careem stockholders as of June 30, 2024. Subject to the limitations in the terms of our existing and future indebtedness, we and our subsidiaries may incur additional debt, secure existing or future debt, or refinance our debt. In particular, we may need to incur additional debt to finance the purchase of autonomous vehicles, and such financing may not be available to us on attractive terms or at all.

Previous wording

Because we conduct a significant and may conduct a growing portion of our business in currencies other than the U.S. dollar but report our consolidated financial results in U.S. dollars, we face exposure to fluctuations in currency exchange rates. As exchange rates vary, revenue, cost of revenue, exclusive of depreciation and amortization, operating expenses, other income and expense, and assets and liabilities, when translated, may also vary materially and thus affect our overall financial results. We have not to date, but may in the future, enter into hedging arrangements to manage foreign currency translation, but such activity may not completely eliminate fluctuations in our operating results due to currency exchange rate changes. Hedging arrangements are inherently risky, and we have limited experience establishing hedging programs, which could expose us to additional risks that could adversely affect our financial condition and operating results.

Current wording

Because we conduct a significant and may conduct a growing portion of our business in currencies other than the U.S. dollar but report our consolidated financial results in U.S. dollars, we face exposure to fluctuations in currency exchange rates. As exchange rates vary, revenue, cost of revenue, exclusive of depreciation and amortization, operating expenses, other income and expense, and assets and liabilities, when translated, may also vary materially and thus affect our overall financial results. Although we have entered into and may in the future enter into hedging arrangements to manage foreign currency translation, such activity may not completely eliminate fluctuations in our operating results due to currency exchange rate changes. Hedging arrangements are inherently risky, and we have limited experience establishing hedging programs, which could expose us to additional risks that could adversely affect our financial condition and operating results.

Previous wording

Starting in December 2020, payments made by platform users with payment accounts in the EEA for services provided through our platform may be subject to Strong Customer Authentication (“SCA”) regulatory requirements. In many cases, SCA will require a platform user to engage in additional steps to authenticate each payment transaction. These additional authentication requirements in EEA or similar requirements, such as tokenization, in other countries may make our platform user experience substantially less convenient, and such loss of convenience could meaningfully reduce the frequency with which platform users use our platform or could cause some platform users to stop using our platform entirely, which could adversely affect our business, financial condition, operating results, and prospects. Further, as a result of implementing SCA, many payment transactions on our platform may fail to be authenticated due to platform users not completing all necessary authentication steps. Thus, in some cases, we may not receive payment from consumers in advance of paying Drivers for services received by those users. A substantial increase in the frequency with which we make Driver payments without having received corresponding payments from consumers could adversely affect our business, financial condition, operating results, and prospects.

Current wording

Payments made by platform users with payment instruments or payment accounts issued in jurisdictions such as the EEA, the UK and Mexico for services provided through our platform may be subject to Strong Customer Authentication (“SCA”) regulatory requirements. In many cases, SCA will require a platform user to engage in additional steps to authenticate each payment transaction. These additional authentication requirements in the EEA, UK and Mexico or similar requirements, such as tokenization, in other countries may make our platform user experience substantially less convenient, and such loss of convenience could meaningfully reduce the frequency with which platform users use our platform or could cause some platform users to stop using our platform entirely, which could adversely affect our business, financial condition, operating results, and prospects. Further, as a result of implementing SCA, many payment transactions on our platform may fail to be authenticated due to platform users not completing all necessary authentication steps. Thus, in some cases, we may not receive payment from consumers in advance of paying Drivers for services received by those users. A substantial increase in the frequency with which we make Driver payments without having received corresponding payments from consumers could adversely affect our business, financial condition, operating results, and prospects.

Previous wording

In addition, laws related to money transmission and online payments are evolving, and changes in such laws could affect our ability to provide payment processing on our platform in the same form and on the same terms as we have historically, or at all. For example, changes to our business in Europe, combined with changes to the EU Payment Services Directive, caused aspects of our payment operations in the EEA to fall within the scope of European payments regulation. As a result, one of our subsidiaries, Uber Payments B.V., is directly subject to financial services regulations (including those relating to anti-money laundering, terrorist financing, and sanctioned or prohibited persons) in the Netherlands and in other countries in the EEA where it conducts business. Effective July 1, 2020, we transitioned all our payment operations to the Uber Payments B.V. regulated entity in the EEA countries in which we are required to do so by the European payments regulations.

Current wording

In addition, laws related to money transmission and online payments are evolving, and changes in such laws could affect our ability to provide payment processing on our platform in the same form and on the same terms as we have historically, or at all. For example, changes to our business in Europe, combined with changes to the EU Payment Services Directive, caused aspects of our payment operations in the EEA to fall within the scope of European payments regulation. As a result, one of our subsidiaries, Uber

Previous wording

Further, our payment system is susceptible to illegal and improper uses, including fraud on our platform such as fraud against us or platform users, money laundering, terrorist financing, fraudulent sales of goods or services, and payments to sanctioned parties. We have invested and will need to continue to invest substantial resources to comply with applicable anti-money laundering and sanctions laws, and in the EEA to conduct appropriate risk assessments and implement appropriate controls as a regulated financial service provider. Government authorities may seek to bring legal action against us if our payment system is used for improper or illegal purposes or if our enterprise risk management or controls in the EEA are not adequately assessed, updated, or implemented, and any such action could result in financial or reputational harm to our business.

Current wording

Further, our payment system is susceptible to illegal and improper uses, including fraud on our platform such as fraud against us or platform users, money laundering, terrorist financing, fraudulent sales of goods or services, and payments to sanctioned parties. We have invested and will need to continue to invest substantial resources to comply with applicable anti-money laundering and sanctions laws, and in certain jurisdictions, such as the EEA, the UK and Mexico to conduct appropriate risk assessments and implement appropriate controls as a regulated financial service provider. Government authorities may seek to bring legal action against us if our payment system is used for improper or illegal purposes or if our enterprise risk management or controls in certain jurisdictions such as the EEA, the UK and Mexico are not adequately assessed, updated, or implemented, and any such action could result in financial or reputational harm to our business.